forked from Minki/linux
348c713441
With CONFIG_FORTIFY_SOURCE enabled, string functions will also perform
dynamic checks for string size which can panic the kernel, like incase
of overflow detection.
In papr_scm, papr_scm_pmu_check_events function uses stat->stat_id with
string operations, to populate the nvdimm_events_map array. Since
stat_id variable is not NULL terminated, the kernel panics with
CONFIG_FORTIFY_SOURCE enabled at boot time.
Below are the logs of kernel panic:
detected buffer overflow in __fortify_strlen
------------[ cut here ]------------
kernel BUG at lib/string_helpers.c:980!
Oops: Exception in kernel mode, sig: 5 [#1]
NIP [c00000000077dad0] fortify_panic+0x28/0x38
LR [c00000000077dacc] fortify_panic+0x24/0x38
Call Trace:
[c0000022d77836e0] [c00000000077dacc] fortify_panic+0x24/0x38 (unreliable)
[c00800000deb2660] papr_scm_pmu_check_events.constprop.0+0x118/0x220 [papr_scm]
[c00800000deb2cb0] papr_scm_probe+0x288/0x62c [papr_scm]
[c0000000009b46a8] platform_probe+0x98/0x150
Fix this issue by using kmemdup_nul() to copy the content of
stat->stat_id directly to the nvdimm_events_map array.
mpe: stat->stat_id comes from the hypervisor, not userspace, so there is
no security exposure.
Fixes:
|
||
|---|---|---|
| .. | ||
| 4xx | ||
| 8xx | ||
| 40x | ||
| 44x | ||
| 52xx | ||
| 82xx | ||
| 83xx | ||
| 85xx | ||
| 86xx | ||
| 512x | ||
| amigaone | ||
| book3s | ||
| cell | ||
| chrp | ||
| embedded6xx | ||
| maple | ||
| microwatt | ||
| pasemi | ||
| powermac | ||
| powernv | ||
| ps3 | ||
| pseries | ||
| fsl_uli1575.c | ||
| Kconfig | ||
| Kconfig.cputype | ||
| Makefile | ||